Bug 258936 - Left shift of negative value in JSC::RegisterAtOffset::offset()
Summary: Left shift of negative value in JSC::RegisterAtOffset::offset()
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-07-06 09:52 PDT by Xi Ruoyao
Modified: 2023-07-13 09:53 PDT (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Xi Ruoyao 2023-07-06 09:52:18 PDT 
JSC::RegisterAtOffset::m_offsetBits is ptrdiff_t, so it's signed.  And
on most platforms the stack grows downward, so the value if often
negative.  The C++ standard explicit deems left shift of negative value
undefined.
Comment 1 Xi Ruoyao 2023-07-06 11:26:37 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/15601
Comment 2 Radar WebKit Bug Importer 2023-07-13 09:53:18 PDT 
<rdar://problem/112205512>